# 102.64.36.235 — IP Intelligence Summary

102.64.36.235 is an IPv4 address operated by Jacobus De Beer (AS327991), geolocated to Vanderbijlpark, South Africa. Its reverse DNS name is ms-36-235.megasurf.co.za. As of October 23, 2026, IPDebrief rates it High Risk (70/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/102.64.36.235
- Last updated: 2026-10-23

## Ownership

- Organization: Jacobus De Beer
- Network name: 102.64.36.0 - 102.64.36.255
- Allocated block: 102.64.36.0/24
- ASN: AS327991 (https://ipdebrief.com/asn/327991)
- Regional registry: AFRINIC

## Location

- City: Vanderbijlpark
- Region: Gauteng
- Country: South Africa
- Time zone: Africa/Johannesburg

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: High Risk (70/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Reverse DNS

- ms-36-235.megasurf.co.za
- Forward-confirmed: yes

## Analyst narrative

\# IP INTELLIGENCE BRIEFING: 102.64.36.235

\## Executive Summary

IP 102.64.36.235 is classified as **HIGH RISK** (Risk Score: 80/100) with confirmed malicious activity indicators. The address is listed on 5 DNSBLs with maximum severity "high" and demonstrates persistent threat behavior. Immediate defensive action recommended.

\## Threat Profile

\- **Risk Score:** 80/100 (High Risk)

\- **Reputation:** High Risk

\- **Geolocation:** Vanderbijlpark, Gauteng, South Africa (ZA)

\- **ASN:** 327991

\- **BGP Prefix:** 102.64.32.0/21

\- **Route Stability:** Unstable (isRouteStable: false)

\- **Control Plane Status:** Active

\## Observed Indicators

\- **DNSBL Listings:** 5 of 8 total lists (severity: high)

\- **DNS Resolution:** ms-36-235.megasurf.co.za (forward confirmed)

\- **Services:** No open ports (Firewalled / No Services)

\- **DNSSEC:** Valid

\- **Campaign Activity:** No known campaign matches

\- **Threat Persistence:** 0 days (no persistent malicious pattern)

\## Neighborhood Analysis

**Subnet:** 102.64.36.0/24 (102.64.36.235/24)

\- **Abuse Density:** 2.1% (moderate)

\- **Total Neighbors:** 97

\- **Risk Distribution:**

\- High Risk: 2 IPs

\- Medium Risk: 68 IPs

\- Low Risk: 18 IPs

\- **Elevated Risk Neighbors:**

\- 102.64.36.8 (Risk: 55)

\- 102.64.36.6, 102.64.36.10, 102.64.36.12 (Risk: 40)

\## Historical Activity

\- **Observations:** 10 recent signal records

\- **Recent Blacklist Activity:** Signal type 2344 (2026-07-27) shows 5 DNSBL listings with high severity

\- **Temporal Pattern:** No persistent malicious behavior detected

\- **Ownership Changes:** 0 changes observed

\## Relationship Graph

\- **DNS Association:** ms-36-235.megasurf.co.za

\- **Related Entities:** Single hostname association

\- **No Additional Links:** No subnet, organization, or certificate relationships identified

\## Recommended Actions

1. **Block at Network Perimeter:** Implement iptables/nftables DROP rule for 102.64.36.0/24

2. **DNSBL Monitoring:** Add to threat intelligence feeds (5 active listings)

3. **Neighbor Assessment:** Investigate 102.64.36.8 (Risk: 55) and other high-risk neighbors in /24

4. **WAF Rules:** Add IP to Cloudflare/AWS WAF blocklist

5. **Alerting:** Configure SIEM alerts for any connections to 102.64.36.0/24 subnet

\## Risk Assessment

This IP demonstrates active threat behavior with multiple DNSBL listings and high-risk classification. The subnet shows moderate abuse density with 2.1% abuse rate and several elevated-risk neighbors. The absence of open services suggests this may be a compromised infrastructure host or honeypot. Monitor for any service activation or lateral movement patterns.

## Nearby addresses

- 102.64.36.1 (https://ipdebrief.com/102.64.36.1)
- 102.64.36.3 (https://ipdebrief.com/102.64.36.3)
- 102.64.36.6 (https://ipdebrief.com/102.64.36.6)
- 102.64.36.7 (https://ipdebrief.com/102.64.36.7)
- 102.64.36.8 (https://ipdebrief.com/102.64.36.8)
- 102.64.36.9 (https://ipdebrief.com/102.64.36.9)
- 102.64.36.10 (https://ipdebrief.com/102.64.36.10)
- 102.64.36.12 (https://ipdebrief.com/102.64.36.12)
- 102.64.36.14 (https://ipdebrief.com/102.64.36.14)
- 102.64.36.15 (https://ipdebrief.com/102.64.36.15)
- 102.64.36.16 (https://ipdebrief.com/102.64.36.16)
- 102.64.36.17 (https://ipdebrief.com/102.64.36.17)

---

Source: IPDebrief, "102.64.36.235 IP intelligence", https://ipdebrief.com/102.64.36.235, updated 2026-10-23. Assessments are probabilistic.